apache/superset · error

User not found.

Error message

User not found.

What it means

Exception('User not found.') is raised by SecurityResetCommand.validate when the acting user is None or is_active is false — the reset only runs for a present, active user, checked after the confirm gate.

Source

Thrown at superset/commands/security/reset.py:54

        confirm: bool,
        user: Any,
        exclude_users: Optional[str] = None,
        exclude_roles: Optional[str] = None,
    ) -> None:
        self._user = user
        self._confirm = confirm
        self._users_to_exclude = ["admin"]
        if exclude_users:
            self._users_to_exclude.extend(exclude_users.split(","))
        self._roles_to_exclude = ["Admin", "Public", "Gamma", "Alpha", "sql_lab"]
        if exclude_roles:
            self._roles_to_exclude.extend(exclude_roles.split(","))

    def validate(self) -> None:
        if not self._confirm:
            raise Exception("Reset aborted.")  # pylint: disable=broad-exception-raised
        if not self._user or not self._user.is_active:
            raise Exception("User not found.")  # pylint: disable=broad-exception-raised

    def run(self) -> None:
        self.validate()
        logger.debug("Resetting Superset Started")
        db.session.query(SqlaTable).delete()
        databases = db.session.query(Database)
        for database in databases:
            db.session.delete(database)
        db.session.query(Dashboard).delete()
        db.session.query(Slice).delete()
        db.session.query(KeyValueEntry).delete()
        db.session.query(Log).delete()
        db.session.query(FavStar).delete()

        logger.debug("Ignoring Users: %s", self._users_to_exclude)
        users_to_delete = (
            db.session.query(security_manager.user_model)
            .filter(security_manager.user_model.username.not_in(self._users_to_exclude))

View on GitHub (pinned to f4587218dd)

Solutions

1. Run the reset as an existing active user (typically the admin account)
2. Re-activate the target user first (update is_active=true) if it must perform the reset
3. Pass the correct authenticated user object/username to the command

Example fix

# before
SecurityResetCommand(user=None, confirm=True).run()

# after
admin = sm.find_user('admin')
assert admin and admin.is_active
SecurityResetCommand(user=admin, confirm=True).run()

assert user is not None and user.is_active, 'reset needs an active user'

def user_can_run_reset(user) -> bool:
    return user is not None and bool(user.is_active)

When it happens

Trigger: Running the security reset where the resolved user is anonymous/None (unauthenticated context) or the account has been deactivated; passing a username that resolves to a disabled user.

Common situations: Invoking reset from a scheduler/Celery context without a user; the 'admin' account deactivated before someone attempted the reset; user record disabled during offboarding while automation still ran.

Related errors

• Package name '{name}' cannot start with a number
• Package name cannot start with Python keyword '{first_part}'
• '{name}' is not a valid Python package name
• '{name}' is a reserved npm package name
• Publisher cannot be empty

AI-assisted analysis of apache/superset@f4587218dd (2026-08-14). Data as JSON: /api/errors/a30e786879e798e7. Report an issue: GitHub.